On Fri, Jan 31, 2020 at 08:48:11PM -0800, syzbot wrote: > Hello, > > syzbot found the following crash on: > > HEAD commit: ccaaaf6f Merge tag 'mpx-for-linus' of git://git.kernel.org.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=115bda4ee00000 > kernel config: https://syzkaller.appspot.com/x/.config?x=879390c6b09ccf66 > dashboard link: https://syzkaller.appspot.com/bug?extid=190005201ced78a74ad6 > compiler: gcc (GCC) 9.0.0 20181231 (experimental) > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1674c776e00000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1565e101e00000 > > IMPORTANT: if you fix the bug, please add the following tag to the commit: > Reported-by: syzbot+190005201ced78a74ad6@xxxxxxxxxxxxxxxxxxxxxxxxx Already reported; see if the following fixes that: diff --git a/fs/namei.c b/fs/namei.c index 4167109297e0..db6565c99825 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -3333,8 +3333,8 @@ static int do_last(struct nameidata *nd, struct file *file, const struct open_flags *op) { struct dentry *dir = nd->path.dentry; - kuid_t dir_uid = dir->d_inode->i_uid; - umode_t dir_mode = dir->d_inode->i_mode; + kuid_t dir_uid = nd->inode->i_uid; + umode_t dir_mode = nd->inode->i_mode; int open_flag = op->open_flag; bool will_truncate = (open_flag & O_TRUNC) != 0; bool got_write = false;
